Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for your personal information is the legally registered entity operating this website:

In this document, "we", "us", or "our" refers to ampowerfit – De Jesus Marques Andreia Sofia.

2. What Personal Data We Collect (Data Map)

We only collect the minimum data required to provide our services. The table below maps exactly what we keep, why, where it is stored, and for how long:

Discount requests and contact-form messages are sent to us by email only — they are not saved in our booking database.

Cookies and similar technologies

Essential cookies run without consent — a security token (anti-fraud / CSRF), your language choice, the coach login session, and a small cookie that records your cookie preferences. They do not track you across other websites.

Analytics & advertising cookies load only if you accept them in our cookie banner: Google Analytics (to see how the site is used), and Google Ads and the Meta (Facebook) Pixel (to measure and improve our advertising). These set cookies in your browser and share data with Google and Meta — see section 5. Nothing in this category runs until you opt in.

You can change or withdraw your choice at any time via “Cookie settings” in the page footer. Until you accept, these trackers stay switched off.

3. Why We Collect It and Our Legal Basis

Under the General Data Protection Regulation (GDPR), we must have a lawful basis for each purpose we process your data for. We do not rely on a single basis for everything — each purpose below uses the one that genuinely fits it:

• Bookings — performance of a contract (Article 6(1)(b)). To manage your booking, confirm your place, and send the related confirmation, reminder and cancellation emails. We need this data to provide the session you are booking; it is not something you can withdraw and still be served.
• Session packs — performance of a contract (Article 6(1)(b)). To keep count of the sessions you have already paid for in advance and deduct them as you book — and, for packs with a deadline, each purchase's validity date and the email that reminds you of it 7 days before. Without that record we could not honour a session you have already paid for.
• Client account — performance of a contract (Article 6(1)(b)). When you choose to sign in, we keep your account (email, name, language) and hashed sign-in codes to give you access to your pack and your sessions. The account is optional: booking does not require one.
• Online payments — performance of a contract (Article 6(1)(b)). When you choose to pay online, we record who paid, what it was for and the amount, so we can confirm your booking or credit your pack — and keep the accounting record of it.
• Invoicing — legal obligation (Article 6(1)(c)) and performance of a contract. If you are invoiced for coaching, we keep your name and billing address in a client record so that we can issue your invoices. That record holds no payment details. We also keep a sales register: what you bought (service, quantity, price, VAT), the date, the payment method, its status and the invoice number. A sale does not carry your name: it points to your client record. The invoices themselves are also kept in the studio's own accounting.
• Contact-form messages — pre-contract steps at your request (Article 6(1)(b)). To read your message and reply to it. Your name, email and message reach us by email and are not stored in our database.
• Testimonials — your consent (Article 6(1)(a)). To display your feedback and name on our website. You give this consent by checking the box before submitting, and you can withdraw it at any time by asking us to take the testimonial down.
• Discount requests — your consent (Article 6(1)(a)). To send the requested discount code to your email.
• Analytics & advertising — your consent (Article 6(1)(a)). Loaded only if you accept the optional cookies in our banner; you can withdraw at any time via “Cookie settings”.
• Security & fraud prevention — our legitimate interest (Article 6(1)(f)). We log basic technical data (IP address, browser, and an approximate country code derived from the IP address) to keep the site secure and prevent abuse. This runs on every visit. These logs are tied to a technical session, never to an account; where they record a request you sent, the personal data in it is masked before being written.

For the consent-based purposes above, you give consent by actively checking the consent box (or accepting cookies) before submitting — and you can withdraw it at any time (see section 7).

4. Where and How Your Data is Stored

The personal data you give us — your bookings, testimonials, session packs and verified-email list — is stored on our own infrastructure within the European Union, not in a third-party cloud database. A few external providers process specific data only to run the service (email delivery, and — with your consent — analytics and advertising); these are listed in sections 2 and 5.

• Secure Infrastructure: All data is securely stored within a protected, locally managed database rather than on public cloud servers.
• Location: The servers hosting your data are physically located within the European Union.
• Security Measures: We employ strict security protocols to prevent unauthorized access. All communication between your browser and our website is encrypted using standard secure protocols (HTTPS), and our database infrastructure is shielded from public access.

5. Data Sharing & Third-Party Processors

We never sell or rent your personal data. We share it only with a small number of trusted providers ("processors"), strictly to run this service and only the data each one needs:

• Email delivery — Google (Google Workspace / Gmail). We send booking, verification, reminder, testimonial and discount emails from a Google Workspace mailbox, so your name and email address pass through Google to deliver them.
• Online payments — Stripe (Stripe Payments Europe, Ltd.). Only when you choose to pay online: your name, email and payment details are processed by Stripe to take the payment. Your card or bank details go to Stripe directly and never touch our servers; we store only the amount, a payment reference and its status. Stripe may transfer data outside the EU under the European Commission's Standard Contractual Clauses — see Stripe's Privacy Policy.
• Website analytics — Google (Google Analytics). Only if you accept analytics cookies: how the site is used (pages viewed, approximate location, device) to help us improve it.
• Advertising — Google (Google Ads) and Meta Platforms (the Facebook / Instagram Pixel). Only if you accept marketing cookies: to measure and target our advertising.

Analytics and advertising load only after you consent, and you can switch them off any time via “Cookie settings” in the footer.

International transfers: Google and Meta may process this data outside the EU, including in the United States, under the European Commission's Standard Contractual Clauses and adequacy decisions. See Google's Privacy Policy and Meta's Privacy Policy.

6. Data Retention

We keep personal data only as long as it is needed. You can ask us to delete yours at any time (section 7); some data is also removed automatically:

• Bookings: Your name, email, phone and message are kept to manage your sessions. A booking that is cancelled or expires is deleted automatically 6 months afterwards, except a late cancellation or no-show that we charged for (the session is not given back), which is kept 24 months as the record of that charge; you can also ask us to remove any booking sooner. A request left awaiting payment is deleted after 6 months; a confirmed session is deleted 24 months after it was booked.
• Session packs: The balance is kept for as long as the pack exists. The movement history is kept for 24 months (so we can answer any question about your balance) and then deleted automatically. An empty pack untouched for 24 months is deleted too — a pack with sessions still in it never is. The per-purchase detail (sessions left and deadline) goes with the pack; a purchase fully used or expired is deleted 24 months later.
• Online payments: The record of an online payment (amount, payment reference, status) is kept for accounting. Your name and email are removed from it automatically 24 months after the payment — the transaction itself stays, with no name attached.
• Invoicing details: Your name and billing address are kept for as long as we invoice you. Once the record is marked as no longer in use, it is deleted automatically after 24 months. You can ask us to delete it at any time. Recorded sales and invoices are accounting records, kept for the period the law requires (10 years in Luxembourg): an erasure request deletes your client record and your account and detaches your sales from your name, but does not delete them.
• Client account: Your account is deleted automatically after 24 months without a sign-in — unless sessions remain in your pack, because the account is your access to them. Sign-in codes (stored hashed) are deleted within 24 hours.
• Emails we send you: A copy of each transactional email (confirmation, reminder, receipt) is kept briefly to guarantee delivery — it lets us retry after a passing failure. A delivered copy is deleted within 7 days; an undeliverable one within 30 days.
• Testimonials: Your name and feedback remain on the website as long as the testimonial is active, or until you request its removal (or the coach takes it down).
• Verified emails: Your email sits in a short list (so you skip re-verifying) for up to 12 months, then it is removed automatically — or sooner if you request erasure.
• Discounts & contact messages: Sent by email only; not stored in our database.
• Technical logs: Automatically rotated and overwritten; never archived long-term.

7. Your GDPR Rights

You have complete control over your data. Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you. If you use the client account, you can download it yourself at any time from the “Your data” section of your account page.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure (Right to be Forgotten): Ask us to delete everything we hold about you — all of your bookings, testimonials, your session pack and its history, and your entry in the verified-emails list — from our database and the website, except the sales and invoices the law requires us to keep (see section 6), which are detached from your name.
• Withdraw Consent: Withdraw your consent at any time (e.g., asking us to take down a previously approved testimonial).

8. Right to Lodge a Complaint

If you feel your data has been mishandled, you have the right to lodge a complaint with the Luxembourg data protection authority: